GET /fieldforce/tasks (supervisor role)
  ↓
resolveAllowedUserIDs(ctx, db, orgID, supervisorUserID)
  1. SELECT team_ids FROM member WHERE id = supervisorUserID AND organization_id = orgID
     → supervisor.teamIDs = ["team_a", "team_b"]
  2. SELECT id FROM member WHERE organization_id = orgID
     → filter rows where team_ids @> ANY(supervisor.teamIDs)  (GIN index used)
     → allowedUserIDs = ["uid1", "uid2", "uid3"]
  3. Inject into TaskFilter.AllowedUserIDs
  4. Repository applies: AND EXISTS (SELECT 1 FROM ff_task_assignments WHERE task_id = ff_tasks.id AND user_id = ANY(?))

CREATE INDEX CONCURRENTLY idx_member_team_ids ON member USING GIN (team_ids jsonb_path_ops);

// Replicating team data into a Go-owned table — violates ADR-0006
type GoTeamMembership struct { TeamID, UserID string } // wrong

// Returning an empty slice instead of nil for non-supervisor — causes empty results
if role != "supervisor" {
    return []string{} // wrong — return nil to skip the filter
}

// Read-only scan of shared member table
func resolveAllowedUserIDs(ctx context.Context, db *gorm.DB, orgID, supervisorID string) ([]string, error) {
    var sup struct{ TeamIDs []string }
    if err := db.Table("member").
        Select("team_ids").
        Where("id = ? AND organization_id = ?", supervisorID, orgID).
        Scan(&sup).Error; err != nil {
        return nil, err
    }
    if len(sup.TeamIDs) == 0 {
        return []string{}, nil // supervisor has no teams — sees nothing
    }
    var members []struct{ ID string }
    db.Table("member").
        Select("id").
        Where("organization_id = ? AND team_ids @> ANY(?)", orgID, pq.Array(sup.TeamIDs)).
        Scan(&members)
    // collect and return member IDs
}

// Nil means no filter (manager/admin sees all)
if role == "supervisor" {
    filter.AllowedUserIDs, _ = resolveAllowedUserIDs(ctx, db, orgID, userID)
}
// filter.AllowedUserIDs == nil → no extra WHERE clause in repository